To check if an email address is valid, start with the cheap checks and stop as soon as one fails: confirm the format, look for domain typos, make sure the domain has mail (MX) records, and screen for disposable or role-based addresses. If it passes all of those, it’s very likely deliverable. If you need certainty that a real person owns it, send a confirmation link; nothing short of that proves ownership.

Here are seven methods, ordered from fastest to most thorough, with what each one does and doesn’t prove.

Quick answer: which method proves what

#	Method	Time per address	Proves
1	Format check	Instant	The address could exist
2	Typo check	Instant	The domain is probably what the person meant
3	MX record lookup	Under a second	The domain can receive mail
4	Disposable domain check	Instant (list lookup)	The address isn’t a throwaway inbox
5	Role and free-provider check	Instant	Context: shared inbox, consumer vs. business
6	SMTP handshake	Seconds	The server accepted the recipient at that moment
7	Confirmation email	Minutes to days	A person controls the inbox and wants your mail

Methods 1 through 5 can be run together in one pass, which is what most verification tools do.

Method 1: Check the format

Most invalid entries fail here. Look at the address and confirm:

There’s exactly one @ with text on both sides.
There are no spaces, commas, or semicolons. (Copy-pasted lists often hide a trailing space or a ; from an Outlook address line.)
The local part (before the @) doesn’t start or end with a dot and has no double dots.
The domain has at least one dot and ends in a real top-level domain.
The whole thing is 254 characters or fewer, the limit established by RFC 3696 erratum 1690. The local part alone can’t exceed 64 octets under RFC 5321.

Provider-specific rules can help, too. Google’s username rules for Gmail say new usernames are 6 to 30 characters and use only letters, numbers, and periods, with no consecutive periods. So jo@gmail.com or john_smith@gmail.com isn’t something a person could create today. Also, dots don’t matter in Gmail addresses: john.smith@gmail.com and johnsmith@gmail.com reach the same inbox, which is useful when you’re deduplicating a list.

Want the full grammar? See what RFC 5321 and 5322 actually allow.

Method 2: Look for typos in the domain

A typo is the most common reason a real customer’s address is wrong. People type fast on phones, and autocorrect doesn’t help.

Watch for:

Transposed letters: gmial.com, hotmial.com
Missing or extra letters: gmal.com, yahooo.com
Wrong top-level domain: gmail.co, yahoo.cm, outlook.con
Missing dot: gmailcom

The fix is simple when the person is still on your form: suggest the correction (“Did you mean jane@gmail.com?”) and let them accept it. If you’re cleaning an old list, you can correct obvious cases, but don’t silently rewrite addresses you aren’t sure about. Our guide to common email typos has a longer list.

Method 3: Look up the domain’s MX records

Next, confirm the domain can receive email. Mail servers for a domain are published as MX records in DNS.

macOS or Linux:

dig +short MX example.com

Windows:

nslookup -type=mx example.com

Python (with the dnspython package):

import dns.resolver

def mx_hosts(domain):
    try:
        answers = dns.resolver.resolve(domain, "MX")
        return sorted((r.preference, str(r.exchange)) for r in answers)
    except (dns.resolver.NXDOMAIN, dns.resolver.NoAnswer):
        return []

print(mx_hosts("example.com"))

How to read the result:

MX hosts returned: the domain accepts mail.
Domain doesn’t exist (NXDOMAIN): the address is invalid.
A single MX of 0 .: this is a null MX under RFC 7505. The domain is declaring that it accepts no email. Invalid.
No MX, but the domain has an A record: RFC 5321 says senders can treat that as an implicit MX. Technically deliverable, but unusual for a real business.

More detail in how to check MX records for any domain.

Method 4: Screen for disposable email domains

Disposable inbox services give out addresses that work for minutes or hours. Someone uses one to grab a coupon or a free trial, and then the inbox disappears. The address will pass Methods 1 to 3 when you collect it and bounce later.

To catch them, compare the domain against a maintained list of disposable providers. Open-source lists exist on GitHub, and most verification tools maintain their own. New disposable domains appear constantly, so any list will miss some; a mix of list checks and other signals (like the email never being confirmed) works best.

Be careful not to lump privacy relays in with disposable services. Apple’s Hide My Email, for example, creates unique random addresses that forward to the user’s real inbox. Those are legitimate, long-lived addresses for people who want privacy.

Method 5: Flag role-based and free-provider addresses

These checks don’t make an address invalid, but they change how you should treat it.

Role-based addresses such as info@, sales@, support@, admin@, and webmaster@ go to a function rather than a person. Many of these names were standardized in RFC 2142 back in 1997. They’re usually deliverable, but they’re shared by several people, so someone who never signed up may see your message and mark it as spam. Many teams accept them on contact forms but keep them off marketing lists.

Free-provider addresses (Gmail, Yahoo, Outlook.com, iCloud, and so on) are perfectly valid. For B2B lead forms, though, knowing that a “VP of Engineering” signed up with a personal Gmail is useful context for lead scoring.

Shortcut: run Methods 1 to 5 in one step

You don’t need to do the first five methods by hand. Our free email verifier checks format, looks up the domain and MX records (including null MX), suggests fixes for common domain typos, and flags disposable, role-based, and free-provider addresses in one pass. It does not connect to the recipient’s mail server over SMTP, so it can’t confirm that a specific mailbox exists. For that, you’d use Method 6 or 7.

Method 6: Run an SMTP handshake check

An SMTP check connects to the domain’s mail server, starts a delivery, and asks about the recipient with RCPT TO, then disconnects before sending a message.

A 550 5.1.1 reply means the mailbox doesn’t exist. Under RFC 3463, 5.1.1 is “bad destination mailbox address.” Google’s version reads roughly “the email account that you tried to reach does not exist,” per its Gmail SMTP error reference.
A 250 reply means the server accepted the recipient for now.

That second point is the problem. Catch-all domains accept every address. Greylisting servers, described in RFC 6647, return temporary 421 or 450 errors to unfamiliar senders on purpose. Some servers accept during SMTP and bounce afterward. And outbound port 25 is blocked on many networks, so you may not be able to run the check at all.

We cover the step-by-step commands and how to read each reply in how to verify an email address without sending.

Method 7: Send a confirmation email

This is the only method that proves a real person controls the address. Send a short message with a unique link and only treat the address as confirmed when someone clicks it.

Best practices for confirmation emails, drawn from the M3AAWG Sender Best Common Practices:

Tell people on the form that they’ll need to check their inbox and click a link.
Send the confirmation right away; M3AAWG recommends within 24 hours at most.
Keep it simple and free of advertising so it doesn’t get filtered.
If someone changes their email address later, confirm the new one the same way.

If the confirmation hard-bounces, you’ve learned the address is invalid without harming your marketing list. If it’s never clicked, don’t add it to ongoing mailings. Read more in double opt-in vs. single opt-in.

Putting it together: a decision flow

Fails format? Reject and ask the person to fix it.
Looks like a typo of a major provider? Suggest the correction; accept their choice.
No working domain or a null MX? Reject.
Disposable domain? Block or flag, depending on your use case.
Role-based or free provider? Accept, but tag it for segmentation or scoring.
Need more certainty for a high-value contact? Consider an SMTP check, and treat catch-all results as unknown.
Need proof of ownership or consent? Send a confirmation link.

FAQ

What’s the fastest way to check if an email is valid?

Paste it into a verifier that runs format, MX, typo, and disposable checks together. That takes a second or two and catches most bad addresses. For a single address you can also run dig MX or nslookup -type=mx on the domain yourself.

Can an email address be valid but still not work?

Yes. An address can pass every format and DNS check and still bounce because the mailbox was deleted or is full, or because the server rejects your mail for policy reasons. That’s why bounce handling is still necessary after verification.

How do I check if an email is valid without the person knowing?

Methods 1 through 6 don’t send anything to the recipient, so they won’t notice. Only Method 7, the confirmation email, involves contacting them. If you’re checking addresses for outreach, make sure your sending still complies with CAN-SPAM and any other laws that apply.

Is a Gmail address with dots different from one without?

No. Google says dots don’t change a Gmail address, so j.smith@gmail.com and jsmith@gmail.com go to the same inbox. That matters when you dedupe lists, though it doesn’t apply to Google Workspace addresses on company domains.

Yes, especially if the form didn’t check them when people typed them in. Typos, fake entries, and disposable inboxes all get through unprotected forms. Checking at the form is the cheapest place to stop them; see real-time email verification for signup forms.

How to Check If an Email Address Is Valid (7 Methods)